CVE-2026-104150High· 8.7▾ TwilightAdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@adonisjs/http-server >= 9.0.0, < 9.1.1@adonisjs/http-server <= 8.2.1Patched in:
@adonisjs/http-server 9.1.1@adonisjs/http-server 8.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105854High· 7.5Payload is a free and open source headless content management system
CVE-2026-104861High· 7.5probe-image-size gets image dimensions without downloading the entire file
CVE-2026-101906High· 8.2Axios is a promise-based HTTP client for the browser and Node.js
CVE-2026-90776High· 7.5Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments
CVE-2026-24001High· 7.5jsdiff is a JavaScript text differencing implementation
CVE-2026-107718Medium· 6.1AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework